Israel enacts the Defense Export Control Law (5766-2007), establishing the Defense Export Control Agency (DECA) under the Ministry of Defense. All defense exports — including cyber weapons like NSO Group's Pegasus spyware — require a license from the Ministry of Defense, giving the Prime Minister and Defense Minister effective veto power over which foreign governments can purchase Israeli surveillance technology.
The framework creates the legal architecture for what becomes spyware diplomacy. Under Benjamin Netanyahu, access to Pegasus becomes a diplomatic tool — offered or withheld as part of foreign policy negotiations. Saudi Arabia under Mohammed bin Salman receives Pegasus access as Israel and Saudi Arabia develop informal security ties. Hungary under Viktor Orbán acquires Pegasus around the 2017 Visegrad summit where Netanyahu courts Central European allies. India under Modi gains access as Israel deepens defense ties. Each sale serves dual purposes: commercial revenue for NSO Group and diplomatic leverage for the Israeli state.
The "state-as-silent-partner" model operates through deliberate ambiguity. NSO Group claims it "only sells to vetted government clients with Ministry of Defense approval" — positioning government licensing as a safeguard. The Ministry of Defense claims it "does not control how clients use the tools" — positioning the commercial relationship as a shield. Neither entity accepts accountability for the documented consequences: Pegasus targeting of journalists (including Jamal Khashoggi's wife, months before his murder), human rights defenders (Ahmed Mansoor, imprisoned in UAE), opposition politicians (65 Catalan leaders), and civil society organizations across 45+ countries.
The licensing regime provides a veneer of democratic oversight while functioning as an enabler. The Ministry of Defense has never publicly revoked a Pegasus license for human rights abuse. The 2021 U.S. Entity List designation of NSO Group — for developing surveillance software used to spy on journalists, activists, and government officials — represents the first significant external accountability mechanism, but it restricts American companies from supplying NSO, not NSO from operating. The structural accountability gap between the licensing state, the selling firm, and the targeting government remains open.